Elementor Pro Flaw CVE-2026-32475 Exploited for WordPress Server Takeovers
Attackers are leveraging an unrestricted file upload vulnerability to deploy webshells and execute arbitrary commands on affected sites.
A critical security vulnerability in the Elementor Pro plugin for WordPress is being actively exploited by attackers to seize full control of web servers. The flaw, tracked as CVE-2026-32475, allows unauthorized actors to bypass security restrictions and execute arbitrary commands on affected systems.
According to reports from BleepingComputer and verified security data, the vulnerability stems from an unrestricted file upload flaw. This weakness enables attackers to deliver webshell payloads directly to the server. Once the webshell is active, the attacker can execute arbitrary commands, effectively granting them administrative access to the underlying server infrastructure and the WordPress installation.
The Scale of the Risk
Elementor Pro is among the most widely deployed page builders in the WordPress ecosystem. Because the plugin is used by a massive install base across a diverse range of industries, it represents a high-value target for threat actors. The ubiquity of the tool means that a single critical flaw can expose hundreds of thousands of websites simultaneously, regardless of the site's specific purpose or industry.
Implications of Server Compromise
Because CVE-2026-32475 facilitates Remote Code Execution (RCE), the impact is a total compromise of the affected server. This level of access allows attackers to steal sensitive database information, deface websites, or install persistent backdoors. Furthermore, a compromised WordPress server can be used as a pivot point, allowing attackers to launch further attacks against other systems within the same internal network.
Current Status and Mitigation
Security researchers have confirmed that the vulnerability is being exploited in the wild. Site administrators using Elementor Pro are urged to ensure their plugins are updated to the latest patched version immediately to close the upload loophole. While the primary mechanism of the attack—the webshell delivery—is well-documented, administrators should also audit their server logs for unauthorized file uploads or unusual command execution patterns that may indicate a prior breach.